chore: use NPM trusted publishing by Copilot · Pull Request #3071 · microsoft/react-native-macos

Copilot · 2026-07-31T16:18:41Z

Replaces the ADO-based npm publish pipeline with a GitHub Actions workflow that uses npm Trusted Publishing (OIDC) for the main publish step — no stored npm token required for npm publish.

Changes

.github/workflows/microsoft-npm-publish.yml — New workflow triggered on *-stable branch pushes. Runs in an npm-publish GitHub environment (add protection rules there). Uses id-token: write + --provenance so yarn exchanges a GitHub OIDC token directly with npmjs.com rather than a stored secret. The npm dist-tag add step (applying additional dist-tags) still requires a NPM_TOKEN secret since OIDC doesn't cover that operation.
.ado/scripts/configure-publish.mts — Added enablePublishingOnGitHubActions() that writes publish_react_native_macos=1 to GITHUB_OUTPUT, so the new workflow can gate its publish steps on this output. Previously only the ADO ##vso[task.setvariable...] signal was emitted.
.ado/scripts/apply-additional-tags.mjs — Token can now come from NODE_AUTH_TOKEN env var as a fallback to --token. When using the env-var path (GHA), the token is not passed as a CLI argument — actions/setup-node has already wired NODE_AUTH_TOKEN into .npmrc, so npm dist-tag add picks it up from there. The --token CLI arg path (ADO) is unchanged.

Manual steps required before this workflow runs

npmjs.com: add a Trusted Publisher for react-native-macos and @react-native-macos/virtualized-lists — repo microsoft/react-native-macos, workflow microsoft-npm-publish.yml, environment npm-publish
GitHub repo Settings → Environments: create the npm-publish environment with desired approval rules
GitHub secret: add NPM_TOKEN to that environment (granular automation token scoped to the two packages, used only for dist-tag operations)
ADO: once verified, disable .ado/publish.yml

- Add enablePublishingOnGitHubActions() to configure-publish.mts so the new GHA workflow can gate publish steps via GITHUB_OUTPUT - Update apply-additional-tags.mjs to fall back to NODE_AUTH_TOKEN env var when --token is not provided; avoids token-in-process-args on GHA - Add .github/workflows/microsoft-npm-publish.yml: OIDC trusted publishing on *-stable branch pushes, with npm-publish environment protection

azure-pipelines · 2026-07-31T16:18:51Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Saadnajmi · 2026-07-31T16:39:39Z

+# Mirrors the trigger used by the Azure Pipelines publish.yml:
+# runs on every push to a stable release branch.


No need for this comment

Saadnajmi · 2026-07-31T16:46:49Z

-function main({ tags, token, "dry-run": dryRun }) {
+function main({ tags, token: tokenArg, "dry-run": dryRun }) {
  if (!tags) {
    console.log("No additional tags to apply");
    return 0;
  }

+  // Prefer explicit --token arg (ADO), fall back to NODE_AUTH_TOKEN env var (GHA OIDC).
+  const token = tokenArg ?? process.env.NODE_AUTH_TOKEN;


I think we want to support dry run, and don't want to support the passed in token

🤖 Copilot: Done — removed --token entirely. Auth now comes exclusively from NODE_AUTH_TOKEN. Updated the ADO job to pass the token via env: NODE_AUTH_TOKEN: $(npmAuthToken) instead of the --token arg.

Saadnajmi · 2026-07-31T16:47:18Z

+      // When --token is explicitly provided (ADO path), pass auth inline so
+      // that npm picks it up without a pre-configured .npmrc.
+      // When NODE_AUTH_TOKEN is used instead (GHA OIDC path), actions/setup-node
+      // has already written .npmrc with `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`,
+      // so no inline auth argument is needed.


No overly verbose comments. Comments are to describe code, not the last turn of AI

🤖 Copilot: Removed.

Saadnajmi · 2026-07-31T16:47:35Z

+/**
+ * Writes `publish_react_native_macos=1` to `GITHUB_OUTPUT` to signal that we
+ * want to enable publishing on GitHub Actions.
+ */
+function enablePublishingOnGitHubActions() {


Function name is self explanatory

🤖 Copilot: Removed.

Saadnajmi · 2026-07-31T16:48:16Z

    enablePublishingOnAzurePipelines();
+    enablePublishingOnGitHubActions();


Should we choose one or the other with an extra Boolean in the file?

🤖 Copilot: Added const isGitHubActions = process.env['GITHUB_ACTIONS'] === 'true' at the top of the file and used it to pick one path — enablePublishingOnGitHubActions() on GHA, enablePublishingOnAzurePipelines() otherwise.

Saadnajmi · 2026-07-31T16:49:59Z

+      # which dist-tag(s) to use.  Outputs:
+      #   publish_react_native_macos – '1' when publishing should proceed
+      #   publishTag                 – the primary npm dist-tag (e.g. 'latest')
+      #   additionalTags             – comma-separated extra tags (may be empty)


Examples of an extra tag

Saadnajmi · 2026-07-31T16:51:10Z

+      #   additionalTags             – comma-separated extra tags (may be empty)
+      - name: Verify release config
+        id: configure-publish
+        run: node .ado/scripts/configure-publish.mts --verbose --skip-auth


Do we still need to skip auth with oidc?

🤖 Copilot: Yes, still needed. verifyNpmAuth() runs npm whoami, which requires a pre-configured token and would fail before any OIDC exchange happens. OIDC auth is initiated by yarn at publish time (via --provenance), not upfront — so there's no token in the environment when configure-publish.mts runs.

I think no callers actually use auth then and we can remove that flow

Saadnajmi · 2026-07-31T16:51:40Z

+      # Configure yarn to target the public npm registry.
+      # Auth is handled by OIDC Trusted Publishing – do NOT set npmAuthToken here.


Remove obvious comment

Saadnajmi · 2026-07-31T16:51:57Z

+      # Publish all non-private workspace packages.
+      # --provenance enables npm Trusted Publishing: yarn requests an OIDC token
+      # from GitHub Actions and exchanges it with npmjs.com – no stored secret needed.


Remove obvious comment

Saadnajmi · 2026-07-31T16:52:55Z

+      # Apply any additional dist-tags (e.g. promoting a branch tag to 'next').
+      # npm dist-tag add does not support OIDC, so a granular NPM_TOKEN secret
+      # is required for this step.  NODE_AUTH_TOKEN is the conventional env var
+      # that actions/setup-node (called inside microsoft-setup-toolchain) wires
+      # into the project-level .npmrc it creates.


Useful comment, can we simplify a little?

🤖 Copilot: Simplified to: # npm dist-tag add doesn't support OIDC, so NODE_AUTH_TOKEN (a granular NPM_TOKEN secret) is still required for this step.

- Remove verbose/obvious comments from workflow and scripts - Drop --token CLI arg from apply-additional-tags.mjs; use NODE_AUTH_TOKEN env var only; update ADO job accordingly - Remove JSDoc from self-explanatory enablePublishingOnGitHubActions() - Add isGitHubActions boolean to configure-publish.mts and use it to select between ADO and GHA signaling (instead of calling both)

Saadnajmi · 2026-07-31T17:52:39Z

+
+      const npmArgs = [
+        "dist-tag",
+        "add",
+        `${pkg}@${version}`,
+        tag,
+        "--registry",
+        registry,
+      ];
+
      const result = spawnSync(
        "npm",
-        [
-          "dist-tag",
-          "add",
-          `${pkg}@${version}`,
-          tag,
-          "--registry",
-          registry,
-          `--//registry.npmjs.org/:_authToken=${token}`,
-        ],
+        npmArgs,


No need to pull this out anymore

Saadnajmi · 2026-07-31T17:54:05Z

+    } else {
+      enablePublishingOnAzurePipelines();
+    }


Can we handle if neither (I.E: local run)? Just a log message may be fine

Saadnajmi · 2026-07-31T17:55:15Z

+      #   additionalTags             – comma-separated extra tags (may be empty)
+      - name: Verify release config
+        id: configure-publish
+        run: node .ado/scripts/configure-publish.mts --verbose --skip-auth


I think no callers actually use auth then and we can remove that flow

Saadnajmi · 2026-07-31T17:55:40Z

+      - name: Configure yarn for npm publishing
+        if: steps.configure-publish.outputs.publish_react_native_macos == '1'
+        run: |
+          yarn config set npmPublishAccess public
+          yarn config set npmPublishRegistry "https://registry.npmjs.org"


Also unset unconditionally after

Copilot AI assigned Copilot and Saadnajmi Jul 31, 2026

Copilot created this pull request from a session on behalf of Saadnajmi July 31, 2026 16:18 View session

Saadnajmi changed the title ~~Switch npm publishing from Azure Pipelines to GitHub Actions with npm Trusted Publishing~~ chore: use npm Trusted Publishing Jul 31, 2026

Saadnajmi marked this pull request as ready for review July 31, 2026 16:19

Saadnajmi requested a review from a team as a code owner July 31, 2026 16:19

Saadnajmi requested changes Jul 31, 2026

View reviewed changes

microsoft-github-policy-service Bot added the Needs: Author Feedback label Jul 31, 2026

Copilot started work on behalf of Saadnajmi July 31, 2026 16:53 View session

microsoft-github-policy-service Bot removed the Needs: Author Feedback label Jul 31, 2026

Copilot finished work on behalf of Saadnajmi July 31, 2026 16:58

Copilot AI requested a review from Saadnajmi July 31, 2026 16:58

Copilot started work on behalf of Saadnajmi July 31, 2026 17:05 View session

chore: remove apply-additional-tags step from GHA npm publish workflow

a2d61ed

Copilot finished work on behalf of Saadnajmi July 31, 2026 17:08

Copilot started work on behalf of Saadnajmi July 31, 2026 17:50 View session

chore: trim verbose comment in npm publish workflow

9cd204e

Copilot finished work on behalf of Saadnajmi July 31, 2026 17:53

Saadnajmi reviewed Jul 31, 2026

View reviewed changes

Copilot started work on behalf of Saadnajmi July 31, 2026 20:33 View session

chore: address review feedback on npm publish scripts and workflow

76a13b6

Copilot finished work on behalf of Saadnajmi July 31, 2026 20:36

Copilot AI requested a review from Saadnajmi July 31, 2026 20:36

Saadnajmi changed the title ~~chore: use npm Trusted Publishing~~ chore: use NPM trusted publishing Jul 31, 2026

		# Mirrors the trigger used by the Azure Pipelines publish.yml:
		# runs on every push to a stable release branch.

		enablePublishingOnAzurePipelines();
		enablePublishingOnGitHubActions();

		# Configure yarn to target the public npm registry.
		# Auth is handled by OIDC Trusted Publishing – do NOT set npmAuthToken here.

Uh oh!

Conversation

Copilot AI commented Jul 31, 2026

Changes

Manual steps required before this workflow runs

Uh oh!

azure-pipelines Bot commented Jul 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants